Add CORS handling for web-components #2006

danpat · 2022-01-28T17:02:07Z

Read CONTRIBUTING.md

I found myself using elements to create an online schema viewer that lives behind an authenticated proxy. Things mostly worked, except for parts of our schema that were remote $ref references in the primary schema document. When elements attempted to resolve them in our environment, the browser console log exploded with CORS-related errors.

After a bunch of digging, it turned out that by default, elements was leaving @stoplight/json-schema-ref-parser use it's default HTTP resolver settings, which has has credentials: 'omit' in the options passed to fetch(). This fails when CORS headers are required.

This PR doesn't change the default, but exposes a new option to the elements-api tag called withCredentials that is passed through to @stoplight/json-schema-ref-parser, allowing user control over whether CORS handling is enabled or not.

I'm not a front-end person by default, so apologies if the style of this PR is out of line, or if I've missed something fundamental. These changes appear to be functioning as intendent in the environment where I have them deployed.

…ng refs in HTTP served schemas.

danpat · 2022-01-28T17:03:28Z

packages/elements-dev-portal/src/version.ts

@@ -1,2 +1,2 @@
 // auto-updated during build
-export const appVersion = '1.6.7';
+export const appVersion = '1.6.9';


Hmm, this isn't a change I made....

This might be automated...

danpat · 2022-01-28T17:04:56Z

packages/elements-core/src/hooks/useBundleRefsIntoDocument.ts

+  const commonBundleOptions: $RefParser.Options = {
+    continueOnError: true,
+    resolve: {
+      http: <$RefParser.HTTPResolverOptions>{ withCredentials },


This is the key needed change to modify how json-schema-ref-parser fetches remote refs.

netlify · 2022-01-28T17:05:53Z

✔️ Deploy Preview for stoplight-elements ready!

🔨 Explore the source changes: 2eead18

🔍 Inspect the deploy log: https://app.netlify.com/sites/stoplight-elements/deploys/61f42191205c000008081f10

😎 Browse the preview: https://deploy-preview-2006--stoplight-elements.netlify.app

netlify · 2022-01-28T17:06:41Z

✔️ Deploy Preview for stoplight-elements-demo ready!

🔨 Explore the source changes: 2eead18

🔍 Inspect the deploy log: https://app.netlify.com/sites/stoplight-elements-demo/deploys/61f42191ec359b000839f5ba

😎 Browse the preview: https://deploy-preview-2006--stoplight-elements-demo.netlify.app/

netlify · 2022-01-28T17:06:41Z

✔️ Deploy Preview for stoplight-elements-dev-portal-storybook ready!

🔨 Explore the source changes: 2eead18

🔍 Inspect the deploy log: https://app.netlify.com/sites/stoplight-elements-dev-portal-storybook/deploys/61f42191a08c73000781cb0e

😎 Browse the preview: https://deploy-preview-2006--stoplight-elements-dev-portal-storybook.netlify.app

netlify · 2022-01-28T17:10:58Z

✔️ Deploy Preview for stoplight-elements ready!

🔨 Explore the source changes: f76c429

🔍 Inspect the deploy log: https://app.netlify.com/sites/stoplight-elements/deploys/622a339bfc4f18000be29d62

😎 Browse the preview: https://deploy-preview-2006--stoplight-elements.netlify.app

netlify · 2022-01-28T17:11:27Z

✔️ Deploy Preview for stoplight-elements-demo ready!

🔨 Explore the source changes: f76c429

🔍 Inspect the deploy log: https://app.netlify.com/sites/stoplight-elements-demo/deploys/622a339bdc55b00009ae93b9

😎 Browse the preview: https://deploy-preview-2006--stoplight-elements-demo.netlify.app/

netlify · 2022-01-28T17:12:00Z

✔️ Deploy Preview for stoplight-elements-dev-portal-storybook ready!

🔨 Explore the source changes: f76c429

🔍 Inspect the deploy log: https://app.netlify.com/sites/stoplight-elements-dev-portal-storybook/deploys/622a339bdfaa3b0008f84f23

😎 Browse the preview: https://deploy-preview-2006--stoplight-elements-dev-portal-storybook.netlify.app

smoores-dev · 2022-01-28T22:39:07Z

We just ran into this today, amazing that this PR was already open. Thanks so much @danpat!

smoores-dev · 2022-02-10T15:40:09Z

Does @mmiask or @mnaumanali94 (or anyone else!) have any time to take a look at this? It would be really awesome to have this functionality!

tilgovi · 2022-02-25T22:50:39Z

In the case @smores and I are hitting it's actually not even a cross-origin request, but it looks like this project is using a fork of json-schema-ref-parser that a resolver that uses isomorphic-fetch and excludes credentials by default by passing 'omit'. If it just passed 'same-origin' as the default that would resolve our issue.

tilgovi · 2022-02-25T22:53:03Z

I think withCredentials is a bit coarse for this use case because schemas might have references that span multiple domains. In practice, most folks are probably resolving from a single domain, but we can't assume that. I would bet the most common need for credentials is same-origin, though. If people want to set it to always send credentials, that's okay, but I can imagine wanting the 'same-origin' default, instead, so that I could have private schemas that reference public schemas and only send credentials for the private ones.

Nezteb · 2022-03-10T17:12:45Z

@marbemac @lottamus How do y'all feel about this?

Nezteb · 2022-03-10T17:22:16Z

Hi @danpat! Thanks for contributing to our OSS project! We'll work on getting this reviewed within the next couple weeks. I just wanted to keep you updated.

tilgovi · 2022-03-10T22:33:54Z

@danpat is your need for actual cross-origin requests, or just same-origin requests with credentials?

When I dug into this, I determined that if the build were not using a fork of json-schema-ref-parser, but instead used webpack to provide Node.js polyfills for the browser via node-libs-browser, we'd be hitting code in stream-http that looks a lot like the resolver in the json-schema-ref-parser fork but defaults to same-origin rather than omit.

https://github.com/jhiesey/stream-http/blob/master/lib/request.js#L148

Since none of this withCredentials related stuff makes sense in a Node.js server environment, I imagine the webpack scenario is what json-schema-ref-parser might be expecting. But, I can't say for sure that someone else doesn't have a requirement to explicitly disable all credentials.

danpat · 2022-03-10T22:57:35Z

@tilgovi Mine is a same-origin situation. Our setup is:

I have elements being served from index.html at https://example.com/myschema/ <- all fetches to this require cookies to get through authentication logic
I have mainschema.yaml at https://example.com/myschema/mainschema.yaml <- elements fetches this fine, cookies are included
I have subschema.yaml at https://example.com/myschema/subschema.yaml <- this file is being referred to by mainschema.yaml like this:

components:
  schemas:
    SubSchema:
      $ref: "./subschema.yaml"

The core issue is that when the remote fetch for https://example.com/myschema/subschema.yaml happens, no cookies are included, so our authentication gateway intercepts the request and returns a 304 redirect to an authentication page.

emanb29 · 2022-05-25T19:49:30Z

My team is having exactly the same problem as @danpat described -- we have an authentication proxy in a same-origin setup with an application that embeds Stoplight Elements. Requests issued by Stoplight lack the credentials: same-origin or credentials: include parameter, causing the authentication proxy to reject the request (redirecting to an authentication endpoint).

Any mechanism that adds pass a parameter to the Stoplight Elements React component letting us specify to use same-origin or include would resolve our problem.

By the principle of least privilege, we would prefer the ability to set same-origin (since we have a same-origin usecase) but include would work too.

As an aside, thanks for the fantastic PR @danpat -- this is exactly the kind of change I was looking for!

aleskovets · 2022-07-05T19:05:07Z

Looks like I am facing the same issue when serving apidocs via "Internal" github pages. With sub-schema reference it tries to hit github auth endpoint and fails with CORS access error.

based on this PR stoplightio#2006

marc-ste · 2023-08-30T10:22:13Z

Is there any update on this?

tilgovi · 2023-09-07T17:43:00Z

I still think this could be solved for most users by fixing the fork of json-schema-ref-parser. The fork being used here uses isomorphic-fetch and specifies omit as the default if credentials aren't requested.¹. The default should be same-origin, which is what browsers do by default and what the webpack polyfill for the Node.js http module does.²

based on this PR stoplightio#2006

Add parameter to configure CORS withCredentials handling when resolvi…

2eead18

…ng refs in HTTP served schemas.

danpat requested a review from mnaumanali94 as a code owner January 28, 2022 17:02

danpat requested review from a team and mmiask January 28, 2022 17:02

Merge branch 'main' into refs_withcredentials

d8f0da4

danpat commented Jan 28, 2022

View reviewed changes

Merge branch 'main' into refs_withcredentials

c3364c9

mnaumanali94 added 2 commits February 28, 2022 20:06

Merge branch 'main' into refs_withcredentials

214dd81

Merge branch 'main' into refs_withcredentials

409f8b2

Merge branch 'main' into refs_withcredentials

f76c429

aleskovets mentioned this pull request Jul 5, 2022

Credentials omitted when resolving external $ref #2151

Closed

mmiask removed their request for review August 22, 2022 09:48

matty-v requested a review from a team August 24, 2022 14:29

matty-v removed the request for review from a team August 24, 2022 14:29

ellyxc pushed a commit to dgitsystems/stoplightio-elements that referenced this pull request Sep 16, 2022

send credential when bundling $ref

5599d9a

based on this PR stoplightio#2006

tupelo-schneck mentioned this pull request Nov 23, 2022

Schema external references fail on password-protected site #2292

Open

ellyxc pushed a commit to dgitsystems/stoplightio-elements that referenced this pull request Apr 17, 2023

send credential when bundling $ref

3e60814

based on this PR stoplightio#2006

ellyxc pushed a commit to dgitsystems/stoplightio-elements that referenced this pull request Nov 1, 2023

send credential when bundling $ref

5480e1c

based on this PR stoplightio#2006

chohmann added the jira label Feb 16, 2024

laurie-dgit pushed a commit to dgitsystems/stoplightio-elements that referenced this pull request May 8, 2024

send credential when bundling $ref

a946b63

based on this PR stoplightio#2006

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add CORS handling for web-components #2006

Add CORS handling for web-components #2006

danpat commented Jan 28, 2022 •

edited by matthewmurphy

danpat Jan 28, 2022

gagarwa Mar 15, 2023 •

edited

danpat Jan 28, 2022

netlify bot commented Jan 28, 2022

netlify bot commented Jan 28, 2022

netlify bot commented Jan 28, 2022

netlify bot commented Jan 28, 2022 •

edited

netlify bot commented Jan 28, 2022 •

edited

netlify bot commented Jan 28, 2022 •

edited

smoores-dev commented Jan 28, 2022

smoores-dev commented Feb 10, 2022

tilgovi commented Feb 25, 2022

tilgovi commented Feb 25, 2022 •

edited

Nezteb commented Mar 10, 2022

Nezteb commented Mar 10, 2022

tilgovi commented Mar 10, 2022

danpat commented Mar 10, 2022

emanb29 commented May 25, 2022

aleskovets commented Jul 5, 2022

marc-ste commented Aug 30, 2023

tilgovi commented Sep 7, 2023

Add CORS handling for web-components #2006

Are you sure you want to change the base?

Add CORS handling for web-components #2006

Conversation

danpat commented Jan 28, 2022 • edited by matthewmurphy

danpat Jan 28, 2022

Choose a reason for hiding this comment

gagarwa Mar 15, 2023 • edited

Choose a reason for hiding this comment

danpat Jan 28, 2022

Choose a reason for hiding this comment

netlify bot commented Jan 28, 2022

netlify bot commented Jan 28, 2022

netlify bot commented Jan 28, 2022

netlify bot commented Jan 28, 2022 • edited

netlify bot commented Jan 28, 2022 • edited

netlify bot commented Jan 28, 2022 • edited

smoores-dev commented Jan 28, 2022

smoores-dev commented Feb 10, 2022

tilgovi commented Feb 25, 2022

tilgovi commented Feb 25, 2022 • edited

Nezteb commented Mar 10, 2022

Nezteb commented Mar 10, 2022

tilgovi commented Mar 10, 2022

danpat commented Mar 10, 2022

emanb29 commented May 25, 2022

aleskovets commented Jul 5, 2022

marc-ste commented Aug 30, 2023

tilgovi commented Sep 7, 2023

danpat commented Jan 28, 2022 •

edited by matthewmurphy

gagarwa Mar 15, 2023 •

edited

netlify bot commented Jan 28, 2022 •

edited

netlify bot commented Jan 28, 2022 •

edited

netlify bot commented Jan 28, 2022 •

edited

tilgovi commented Feb 25, 2022 •

edited